
    /**  
    * @Title: CsrfFilter.java
    * @Package com.efast.cafe.framework.filter
    * @Description: TODO(用一句话描述该文件做什么)
    * @author Administrator
    * @date 2019年4月22日
    * @version V1.0  
    */
    
package com.efast.cafe.framework.filter;

import java.io.IOException;
import java.util.Arrays;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import com.efast.cafe.util.ConfigUtil;
import com.efast.cafe.util.StringUtil;

/**
    * @ClassName: CsrfFilter
    * @Description: TODO(这里用一句话描述这个类的作用)
    * @author Administrator
    * @date 2019年4月22日
    *
    */

public class CsrfFilter  implements Filter{

	private List<Pattern> patterns;
	
	boolean enableCsrf = Boolean.parseBoolean(ConfigUtil.getValue("cafe.csrf"));
	
	String referer = ConfigUtil.getValue("cafe.system.referer");
	
	
	public void setPatterns(List<Pattern> patterns) {
		this.patterns = patterns;
	}
	
	public CsrfFilter(List<Pattern> patterns){
		this.patterns = patterns;
	}
	
	/**
	   * 是否需要过滤
	   * @param url
	   * @return
	   */
	  private boolean isInclude(String url) {
		if(null!=patterns){
			for (Pattern pattern : patterns) {
			      Matcher matcher = pattern.matcher(url);
			      if (matcher.find()) {
			        return true;
			      }
			}
		}
	    return false;
	  }


	
	    /* (非 Javadoc)
	    * 
	    * 
	    * @param filterConfig
	    * @throws ServletException
	    * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
	    */
	    
	@Override
	public void init(FilterConfig filterConfig) throws ServletException {
		
	}


	
	    /* (非 Javadoc)
	    * 
	    * 
	    * @param request
	    * @param response
	    * @param chain
	    * @throws IOException
	    * @throws ServletException
	    * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
	    */
	    
	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest httpRequest = (HttpServletRequest) request;
	    HttpServletResponse httpResponse = (HttpServletResponse) response;
		String url = httpRequest.getServletPath();
		
		if (!isInclude(url) && enableCsrf){
			HttpSession session = httpRequest.getSession();
	        Object token = session.getAttribute("token");
	        String headerToken = httpRequest.getHeader("token");
	        String headerReferer = httpRequest.getHeader("Referer");
	        List<String> refererAry =  Arrays.asList(referer.split(","));
	        if(token!=null && StringUtil.isNotBlank(headerToken) && headerToken.equals(token.toString())
	        		&& refererAry.contains(headerReferer)){
	        	chain.doFilter(httpRequest, httpResponse);
	        	return;
	        }
	        httpResponse.setStatus(403);
		}else{
	    	chain.doFilter(httpRequest, httpResponse);
	    }
	}


	
	    /* (非 Javadoc)
	    * 
	    * 
	    * @see javax.servlet.Filter#destroy()
	    */
	    
	@Override
	public void destroy() {
		// TODO Auto-generated method stub
		
	}
}
